Router Firewall Settings Explained (SPI, NAT & Rules)
Inside every router's Firewall menu sits a collection of cryptic acronyms—SPI, NAT Filtering, DoS Protection, WAN Ping, and SIP ALG—that directly govern both your network security and real-time application stability. Turning on the wrong toggle can cripple WiFi Calling and Zoom audio, while turning off SPI exposes IPv6 hosts directly to the internet.
- Keep SPI Firewall Enabled: Stateful Packet Inspection tracks active TCP/UDP connection states (
ESTABLISHED, RELATED) and drops unsolicited inbound WAN packets. - Disable SIP ALG immediately: The Session Initiation Protocol Application Layer Gateway rewrites VoIP headers poorly, causing one-way audio and dropped calls on WiFi Calling, RingCentral, and 8x8.
- NAT is not a firewall (especially on IPv6): While IPv4 NAT hides internal IPs incidentally, IPv6 assigns globally routable addresses (
2001:.../2600:...) to every device, making your stateful IPv6 firewall mandatory. - Avoid DMZ Host unless isolating a secondary firewall: Placing a PC or console in the router DMZ exposes all 65,535 TCP and UDP ports to internet scanners.
Stateful Packet Inspection (SPI) vs NAT: How They Differ
People often confuse NAT (Network Address Translation) with a firewall. On IPv4, NAPT (masquerading) translates multiple private LAN addresses (192.168.1.x) into a single public WAN IPv4 address using source port translation. Because the router has no port mapping for unsolicited inbound packets on IPv4, it drops them—giving NAT an accidental firewall-like side effect.
Stateful Packet Inspection (SPI)—implemented via the Linux kernel's nf_conntrack engine—goes far deeper. SPI inspects packet headers, TCP sequence numbers, and connection states (NEW, ESTABLISHED, RELATED, INVALID). Even if a port is mapped, SPI drops malformed TCP flag combinations (such as SYN-FIN or Christmas-tree scans), verifies that incoming UDP responses match an active outbound query within a strict timeout window, and prevents ACK scan traversal. Always keep Enable SPI Firewall (and Enable IPv6 Firewall) turned ON.
Why You Should Disable SIP ALG (Fixing VoIP & WiFi Calling)
Deep inside your router's Firewall or WAN > NAT Passthrough tab, you will see a setting called SIP ALG (Session Initiation Protocol Application Layer Gateway). Designed twenty years ago before modern STUN/TURN/ICE NAT-traversal standards existed, SIP ALG intercepts unencrypted VoIP traffic on UDP/TCP 5060 and attempts to rewrite private IP addresses inside the SIP SDP payload on the fly.
In modern networks, router SIP ALG implementations corrupt SIP headers, break TLS-encrypted signaling, and cause classic VoIP failures: phones fail to register, incoming calls never ring, or calls connect with one-way audio (where you can hear the caller, but they cannot hear you). Disabling SIP ALG (while leaving IPsec Passthrough enabled for WiFi Calling's UDP 500/4500 ePDG tunnels) immediately resolves 90% of home-office VoIP and smartphone WiFi Calling dropouts.
WAN Ping (ICMP), DoS Protection, and NAT Filtering Modes
Three additional firewall toggles control how your WAN interface responds to external probes and gaming traffic:
- Respond to Ping on Internet / WAN Port: Keep this Disabled for everyday security so automated Shodan and Masscan ICMP sweeps see your IP as offline. Only enable WAN ICMP Echo temporarily if you are configuring an automated uptime monitor like Broadband Quality Monitor (ThinkBroadband BQM).
- DoS Protection: Enforces rate limits on SYN floods and port scans. Keep it enabled, but note that overly aggressive DoS thresholds on cheap routers can falsely trigger when BitTorrent or Steam queries hundreds of UDP peers at once.
- NAT Filtering (Secured vs Open on NETGEAR): Secured enforces Port-Restricted Cone NAT (highest security), whereas Open enables Endpoint-Independent / Full-Cone NAT to give gaming consoles an Open NAT type without UPnP.
IPv6 Firewall Statefulness and the Danger of DMZ Host
When your ISP provides dual-stack IPv6 (via DHCPv6-PD), every phone, laptop, and smart TV on your home WiFi receives its own publicly routable Global Unicast Address (starting with 2000::/3, such as 2600:... or 2a00:...). There is no NAT in IPv6. The only barrier preventing anyone on the public internet from connecting directly to port 445 or 80 on your devices is your router's Stateful IPv6 Firewall—never disable the IPv6 firewall to troubleshoot connectivity.
Similarly, stay away from the DMZ (Demilitarized Zone) Host feature under WAN settings. Consumer router DMZ does not create an isolated enterprise subnet; instead, it creates a 1-to-1 wildcard port forward (1–65535) to a single LAN device. Only use DMZ Host if you are forwarding all traffic to the WAN port of a dedicated downstream firewall (like pfSense/OPNsense).
Router Firewall Settings: Recommended State & Impact Guide
| Firewall Setting | Recommended State | Primary Function | When to Change It |
|---|---|---|---|
| SPI IPv4 Firewall | Enabled (ON) | Drops unsolicited WAN packets & invalid TCP flags | Never disable on an internet-facing router |
| IPv6 Stateful Firewall | Enabled (ON) | Blocks direct inbound WAN access to global IPv6 hosts | Add explicit pinholes only for specific IPv6 servers |
| SIP ALG (NAT Passthrough) | Disabled (OFF) | Legacy VoIP packet header rewriter on port 5060 | Keep OFF; enables clean VoIP, Zoom & WiFi Calling |
| Respond to WAN Ping (ICMPv4) | Disabled (OFF) | Drops external ICMP Echo Request probes | Enable only if running external BQM latency graphs |
| DMZ Host | Disabled (OFF) | Forwards all unmapped WAN ports (1–65535) to one IP | Use only to pass WAN to a secondary router/firewall |
Router Firewall Configuration Audit Checklist
- Verify both the IPv4 SPI Firewall and the IPv6 Stateful Firewall are enabled in the router security menu.
- Disable SIP ALG (and H.323 ALG) under WAN/NAT Passthrough to prevent corrupted VoIP and WiFi Calling audio streams.
- Keep IPsec Passthrough enabled so iOS and Android smartphones can establish UDP 4500 tunnels to carrier WiFi Calling gateways.
- Ensure 'Respond to Ping on WAN Port' is disabled unless actively running an external broadband quality monitor.
- Confirm the DMZ Host IP field is blank/disabled and audit the Port Forwarding table for forgotten or unrecognized rules.
- Run an external port scan from cellular data (or grc.com ShieldsUP) to confirm all common WAN ports report Stealth/Filtered.
Frequently Asked Questions
If I disable WAN Ping (ICMP Echo) on IPv4, does that also break IPv6?
Be careful: while dropping ICMPv4 Echo Requests on WAN is completely safe, IPv6 relies heavily on ICMPv6 for Neighbor Discovery and Path MTU Discovery (Packet Too Big, Type 2). Modern routers block inbound ICMPv6 Echo Requests (pings) when you toggle off WAN Ping while properly allowing essential RFC 4890 ICMPv6 control types.
Why do VoIP providers like RingCentral, Nextiva, and 8x8 always ask to disable SIP ALG first?
Modern cloud VoIP phones handle NAT traversal automatically using TLS encryption and STUN/Keepalive packets. When a router's SIP ALG inspects and alters the internal IP headers of those packets, it breaks checksums and port mappings, resulting in dropped calls at the 30-second or 15-minute mark.
Is it safe to put my PlayStation 5 or Xbox Series X in the router's DMZ to get an Open NAT?
No. Putting a gaming console in the DMZ exposes every open service port on that console to the public internet and still allows lateral access to the rest of your LAN if a game or browser vulnerability is exploited. Instead, forward only the specific UDP ports required by Xbox Live (UDP 3074) or PSN.
Related Home Network Security & Engineering Guides
- How to Secure Smart Home & IoT Devices on Your Network — Isolate untrusted smart TVs, cameras, and plugs on a dedicated IoT WiFi VLAN. Enable mDNS UDP 5353 reflection for AirPlay and block risky WAN callbacks.
- How to Set Up a VPN Kill Switch on a Router — Prevent ISP IP leaks when your VPN tunnel drops. Configure a strict router-level VPN kill switch on ASUS VPN Fusion, GL.iNet, UniFi, and OpenWrt firewalls.
- IPv6 Router Settings Explained — Configure IPv6 router settings for Comcast Xfinity, AT&T Fiber, and Verizon Fios. Set up Native DHCPv6-PD, SLAAC, /56 or /60 prefix delegation, and firewalls.
- Parental Control Setup on a Router — Configure router parental controls that kids cannot bypass: set up Family DNS (1.1.1.3), defeat MAC address randomization, and create a Kid-Safe WiFi SSID.